Privacy Policy

The controller responsible for the processing of your personal data in connection with nucpros.com (the "Website") is:

Avalon B.V. Imperiastraat 8 1930 Zaventem, Belgium Email: [email protected] Phone: +1 (260) 508-2188

Avalon B.V. is the seller of the products offered on the Website, the party processing your payments, and the party responsible for customer service, claims and refunds. This Privacy Policy explains what personal data we collect, why, how long we keep it, and your rights under the General Data Protection Regulation (EU) 2016/679 ("GDPR") and applicable national law.

Order and account data: name, delivery address, billing address, email address, phone number, order history, products purchased.

Payment data: payment method, transaction reference, billing details. Full card numbers are processed directly by our payment service providers and are not stored by us.

Communication data: the content of emails, contact-form messages, phone calls and other correspondence with our customer service.

Technical and usage data: IP address, device type, browser type, operating system, language, referring website, pages visited, time and date of visits, and interactions with the Website, collected via cookies and similar technologies.

Marketing data: your email address and marketing preferences if you subscribe to our newsletter or consent to marketing communications.

We do not intentionally collect health data. Any information you voluntarily share with customer service about your health in relation to a product is used only to answer your enquiry and is not stored for any other purpose.

Processing and delivering your order, including payment processing, fraud prevention, shipping and delivery notifications. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

Customer service, handling returns, refunds, complaints and warranty claims. Legal basis: performance of a contract (Art. 6(1)(b)) and our legitimate interest in providing good customer service (Art. 6(1)(f)).

Complying with legal obligations, including tax, accounting and consumer protection law. Legal basis: legal obligation (Art. 6(1)(c)).

Sending marketing emails about our products and offers, where you have consented or where permitted by law for existing customers (with the option to opt out at any time). Legal basis: consent (Art. 6(1)(a)) or legitimate interest (Art. 6(1)(f)).

Operating, securing and improving the Website, including analytics and measurement of advertising performance. Legal basis: legitimate interest (Art. 6(1)(f)) for essential and security-related processing; consent (Art. 6(1)(a)) for non-essential cookies and tracking technologies.

Establishing, exercising or defending legal claims. Legal basis: legitimate interest (Art. 6(1)(f)).

We use cookies and similar technologies on the Website.

Strictly necessary cookies are required for the Website to function (for example, keeping items in your cart, completing checkout, security). These do not require consent.

Analytics and performance cookies help us understand how visitors use the Website so we can improve it.

Marketing and advertising cookies are used to measure and optimise our advertising campaigns and, where applicable, to show you relevant advertisements on third-party platforms.

Non-essential cookies are only placed with your consent, which you can give, refuse or withdraw at any time via the cookie settings on the Website. You can also control cookies through your browser settings. Refusing cookies may affect the functionality of some parts of the Website.

We share personal data only to the extent necessary with the following categories of recipients, who act on our instructions as processors or as independent controllers where required by law:

E-commerce platform and hosting providers that operate the Website and store order data. Payment service providers and banks that process your payments and perform fraud checks. Fulfilment and logistics partners and postal or courier companies that pick, pack and deliver your order. Email and customer-service software providers used to communicate with you. Analytics and advertising service providers, subject to your cookie consent. Professional advisers, including accountants, auditors and lawyers. Public authorities, where we are legally required to disclose data.

We do not sell your personal data.

Your data is primarily processed within the European Economic Area (EEA). Some of our service providers may process data outside the EEA. Where this happens, we ensure appropriate safeguards are in place, such as an adequacy decision of the European Commission or the European Commission’s Standard Contractual Clauses, supplemented where necessary by additional measures. You may request a copy of the relevant safeguards by contacting us.

Order, invoice and payment records: for as long as required by tax and accounting law (generally up to 10 years from the end of the relevant financial year, depending on applicable law). Customer service correspondence: up to 3 years after the matter is closed, unless needed longer for a legal claim. Marketing data: until you unsubscribe or withdraw consent, or after 3 years of inactivity. Technical and cookie data: according to the lifetime of each cookie, as described in our cookie settings.

When data is no longer needed, we delete or anonymise it.

Under the GDPR you have the right to:

Access the personal data we hold about you. Rectify inaccurate or incomplete data. Erase your data, in certain circumstances. Restrict processing, in certain circumstances. Data portability, receiving your data in a structured, commonly used, machine-readable format. Object to processing based on legitimate interests, and to object at any time to direct marketing. Withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.

To exercise your rights, contact us at [email protected]. We will respond within one month, extendable by two further months where necessary. We may ask you to verify your identity before acting on your request.

You also have the right to lodge a complaint with a supervisory authority. Our lead supervisory authority is the Office of the Commissioner for Personal Data Protection of Cyprus (www.dataprotection.gov.cy). You may also complain to the data protection authority in your country of residence, for example CNIL (France), IMY (Sweden), Datatilsynet (Denmark) or the Office of the Data Protection Ombudsman (Finland).

We use appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, alteration or disclosure, including encrypted connections (TLS/SSL), access controls and secure payment processing through PCI DSS compliant providers.

The Website is not directed at persons under 18 years of age, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

We may update this Privacy Policy from time to time. The current version is always available on the Website with the date of the last update. Material changes will be communicated on the Website or by email where appropriate.

For any questions about this Privacy Policy or how we process your personal data:

Avalon B.V. Imperiastraat 8 1930 Zaventem, Belgium Email: [email protected] Phone: +1 (260) 508-2188